[spdd] Add spec implementation tracking, drift SLA guidance, and harness traceability updates

[Copilot]

This daily SPDD issue identified missing implementation visibility in safe-output outcome specs, missing SLA tracking details for config drift, and weak spec↔implementation sync guidance across AW harness and threat-detection specs. This PR tightens those gaps with explicit status mapping, traceability, and version/sync anchors.

• Safe-output outcome spec: implementation visibility + metrics ownership

  • Added an Implementation status column (implemented / partial / not-started) for outcome types.
  • Filled coverage across the outcome table, including explicit add_reviewer implementation references in both Go and JS areas.
  • Extended Derived Metrics with concrete ownership: Go aggregation location and OTel span emission location per metric.

• AWF config source spec: actionable drift operations

  • Updated the Section 4.3 drift-check CLI example to current gh api path style and stronger schema-key extraction.
  • Added explicit GH token precondition in snippet.
  • Added direct workflow path link for schema consistency automation.
  • Added Drift SLA tracking subsection for CR-06 with concrete labels (workflow, bug) and escalation issue shape ([Schema Drift SLA] + owner/unblock plan/revised ETA fields).

• AW Harness spec: budget-exhaustion recovery norm + traceability

  • Expanded safeguards for budget hard-stop behavior to define:
    • preserved durable artifacts,
    • discarded in-flight state,
    • forced-termination signaling fields.
  • Added definition for a “completed turn boundary”.
  • Added a MUST/MUST NOT traceability matrix mapping normative requirements to expected aw_harness.cjs guards.

• Compiler threat detection spec: version-sync anchor

  • Added Spec-to-Implementation Sync section with explicit spec version ↔ minimum gh-aw binary version mapping and lock-file compatibility note.
  • Renumbered and normalized section references to keep cross-links consistent after insertion.

• Security architecture summary: forward maintenance signal

  • Added a pending item in the Spec Maintenance table to keep next-step tracking live instead of fully closed.

• Safe output handlers JS: spec cross-reference comments

  • Added inline cross-reference comments at handler entry points to align runtime handlers with numbered outcome sections (and mark non-numbered types explicitly).

| Output type | Implementation status | Go implementation areas | JS/runtime implementation areas |
|-------------|------------------------|--------------------------|---------------------------------|
| `add_reviewer` | not-started | `pkg/workflow/add_reviewer.go`, `pkg/workflow/safe_outputs_config.go` | `actions/setup/js/add_reviewer.cjs`, `actions/setup/js/safe_outputs_handlers.cjs` |

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/graphql
  • Triggering command: /usr/bin/gh gh auth status /opt/hostedtoolcGO111MODULE -o /tmp/go-build276GOINSECURE -trimpath 64/bin/go -p golang.org/x/tooenv -lang=go1.25 go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[Copilot]

Pull request overview

This PR updates several SPDD specs (and adds a few inline JS cross-references) to improve spec↔implementation traceability, make config-drift handling more actionable, and anchor version/sync expectations across the harness and threat-detection specs.

Changes:

• Added implementation status tracking and ownership/traceability details for safe-output outcome evaluation and derived metrics.
• Strengthened AWF config drift operational guidance (CLI example, automation link, and explicit SLA escalation conventions).
• Inserted a spec↔binary version sync section into the compiler threat-detection spec and renumbered cross-references accordingly.

Show a summary per file

File	Description
specs/security-architecture-spec-summary.md	Adds a pending maintenance tracker item for spec-to-lock sync guidance.
specs/safe-output-outcome-evaluation.md	Adds implementation-status mapping table and expands derived-metrics ownership columns.
specs/compiler-threat-detection-spec.md	Adds spec-to-implementation sync table and renumbers sections/cross-links.
specs/awf-config-sources-spec.md	Updates drift-check CLI example, adds workflow reference link, and documents drift SLA escalation format.
specs/aw-harness.md	Clarifies budget hard-stop semantics and adds a spec↔source traceability matrix.
actions/setup/js/safe_outputs_handlers.cjs	Adds inline spec cross-reference comments at key safe-output handler entry points.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comments suppressed due to low confidence (1)

specs/compiler-threat-detection-spec.md:288

• This bullet references "Section 5.3.1" for the deprecation policy, but there is no §5.3.1 anchor (the doc currently contains a mismatched "#### 4.3.1 Deprecation Policy"). Update the subsection numbering/anchor (or change this reference) so the link resolves correctly.

- Each active CTR rule MUST have at least one test ID in Section 8.1 that covers the primary detection trigger.
- Tests MUST be deterministic: given the same malicious or unsafe input, the compiler MUST always emit the same diagnostic.
- Tests MUST assert the stable diagnostic ID (e.g., `CTR-006`) appears in the compiler error output so that CI can mechanically verify rule coverage.
- When a new rule is added to Section 5.1, at least one new test ID MUST be added to Section 8.1 in the same change set.
- When a rule is deprecated per Section 5.3.1, its test IDs MUST be marked `[DEPRECATED]` and removed from the required compliance gate.

• Files reviewed: 6/6 changed files
• Comments generated: 5